CVE-2019-14530

An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.

• CWE-22

• http://packetstormsecurity.com/files/163215/OpenEMR-5.0.1.7-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/163375/OpenEMR-5.0.1.7-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/Hacker5preme/Exploits/tree/main/CVE-2019-14530-ExploitExploit, Third Party Advisory
• https://github.com/Wezery/CVE-2019-14530Exploit, Third Party Advisory
• https://github.com/openemr/openemr/pull/2592Patch, Third Party Advisory
• http://packetstormsecurity.com/files/163215/OpenEMR-5.0.1.7-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/163375/OpenEMR-5.0.1.7-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/Hacker5preme/Exploits/tree/main/CVE-2019-14530-ExploitExploit, Third Party Advisory
• https://github.com/Wezery/CVE-2019-14530Exploit, Third Party Advisory
• https://github.com/openemr/openemr/pull/2592Patch, Third Party Advisory

Published

Aug 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14525In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6,…
• CVE-2019-14526An issue was discovered on NETGEAR Nighthawk M1 (MR1100) dev…
• CVE-2019-14527An issue was discovered on NETGEAR Nighthawk M1 (MR1100) dev…
• CVE-2019-14528GnuCOBOL 2.2 has a heap-based buffer overflow in read_litera…
• CVE-2019-14529OpenEMR before 5.0.2 allows SQL Injection in interface/forms…9.8
• CVE-2019-1453A denial of service vulnerability exists in Remote Desktop P…7.5
• CVE-2019-14531An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There…
• CVE-2019-14532An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There…9.8
• CVE-2019-14533The Control function of demux/asf/asf.c in VideoLAN VLC medi…
• CVE-2019-14534In VideoLAN VLC media player 3.0.7.1, there is a NULL pointe…
• CVE-2019-14535A divide-by-zero error exists in the SeekIndex function of d…
• CVE-2019-14537YOURLS through 1.7.3 is affected by a type juggling vulnerab…